The present invention relates to an information processing apparatus and an information processing method capable of detecting manipulation of a program by a third party. In particular, the present invention relates to an information processing apparatus, an information processing method and a record medium capable of detecting manipulation of an operating system by a third party.
Conventionally, in order to ensure the security of a workstation, a personal computer and the like, authorization is set for a program to be operated, for a user to operate a program and the like, so that operations are authorized only within a range of set authorization. In a method for ensuring the security by setting authorization, an operating system executes authorization setting, monitoring and the like. Accordingly, a normal operation of an operating system is the prerequisite.
As a method for preventing only manipulation of a program, a method is often used for making a memory analysis difficult by arranging a program in a random manner in a memory every time a program is loaded to the memory, for example. In this method, the risk of program manipulation can be decreased by making a memory analysis during execution of a program from another program difficult. Moreover, manipulation of a program can be detected by periodically monitoring a memory in which a program is loaded and stopping execution of the program when a program storage area of the memory is changed.
Moreover, a method has been developed for detecting access violation by separately providing an access monitoring device, which is hardware for detecting access violation of a program, and monitoring a signal outputted to a memory (see Japanese Patent Application Laid-Open No. 2001-325150). In this case, an operating system manages information for identifying a running program, and the access monitoring device, which is hardware, judges whether an access to the memory by a program is unauthorized or not, on the basis of the information for identifying the program.